Contents

Introduction

This document describes how to alter the Cisco Email Security Appliance (ESA) and CIsco Security Management Appliance (SMA) cipher settings in order to prevent negotiations for null or anonymous ciphers.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

Cisco ESA

Cisco SMA

Components Used

The information in this document is based on all versions of the Cisco ESA and Cisco SMA.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

How do you prevent negotiations for null or anonymous ciphers?

ESA

By default, the ESA Transport Layer Security (TLS) includes Secure Sockets Layer Version 2 (SSLv2) and ciphers below 128 bits. You can modify the ciphers that are used on the ESA with the sslconfig CLI command.

In order to prevent ESA negotiations for null or anonymous ciphers, enter the sslconfig command into the ESA CLI and apply these settings:

Tip: SSL Version 3.0 (RFC-6101) is an obsolete and an insecure protocol. There is a vulnerability in SSLv3 CVE-2014-3566 known as Padding Oracle On Downgraded Legacy Encryption (POODLE) attack, Cisco bug ID CSCur27131. The recommendation is to to disable SSLv3 while you change the ciphers and use TLS only, and select option 3 (TLS v1). Review the provided Cisco bug ID CSCur27131 for complete details.

SMA

The sslconfig command is not available for the Cisco SMA, so you must complete these steps from the CLI in order to modify the SSL ciphers: